Parser for parsing data packets

ABSTRACT

A parser system is arranged to receive a data stream ( 1 ) having interleaved sections derived from a plurality of different packets, and to extract data from each section as it arrives. The parser system has a scanning section which receives information about each of the sections of data defining which packet it relates to, and employs this information and the properties of the data stream, to identify the locations of layer ( 2 ), layer ( 3 ) and layer ( 4 ) data. This information is passed to parser units ( 7 ), ( 9 ) which extract data based on this data and also offsets. The offsets for the parser ( 7 ) are stored in user-programmable registers ( 9 ).

RELATED APPLICATIONS

The present rule is a group of five patent application having the samepriority date. Application PCT/SG02/000211 relates to an switch havingan ingress port which is configurable to act either as eight FE (fastEthernet) ports or as a GE (gigabit Ethernet port). ApplicationPCT/SG02/000210 relates to a parser suitable for use in such as switch.Application PCT/SG02/000207 relates to a flow engine suitable for usingthe output of the parser to make a comparison with rules. ApplicationPCT/SG02/000209 relates to monitoring bandwidth consumption using theresults of a comparison of rules with packets. ApplicationPCT/SG02/000213 relates to a combination of switches arranged as astack. The respective subjects of the each of the group of applicationsother than in combination with the technology described in the otherfour application, but the disclosure of the other applications of thegroup is incorporated by reference.

FIELD OF THE INVENTION

The present invention relates to a parser system for parsing multipledata packets to extract information from them. In a particular example,the parser system may be employed in a switch such as an Ethernet switchto parse received data packets and thereby obtain information which isrequired for processing the packet by the queue management system andswitching fabric.

BACKGROUND OF INVENTION

Recent advances in Internet technology have changed the way we exchangeinformation. Ubiquitous use of the Internet has led to the idea ofconvergence, The different types of data (e.g. video, sounds, picturesand text) must traverse the same network, and this has given rise to aplethora of protocols which aim to transmit real time and data trafficon a single network with quality of service support.

Chief among these protocols are DiffServ, IntServ and MPLS, which eachrequire packet classification (i.e. determination of the packet's type)in real time when it is received. The first step in this classificationis to extract relevant bytes from a packet, “parsing”. This is describedin Chapter I of “Computer Networks”, Andrew S Tanenbaum, Prentice Hall2^(nd) Ed, 1988.

The parsing operation includes determining whether the packet includestags. For example, conventionally Ethernet packets may include a VLAN(virtual local area network) tag—i.e. a tag which indicates a VLANassociated with the packet. A VLAN tag is conventionally 4-bytesinserted into the Ethernet frame between the Source MAC Address fieldand the Length/Type field. The first 2 bytes of the VLAN tag are alwaysset to a value of 0x8100, while the second two bytes are controlinformation (user priority field, canonical format indicator and VLANidentifier).

Another type of tag is defined by the SNAP protocol (subnetwork accessprotocol), which was introduced to allow older frames and protocols tobe encapsulated in a Type 1 LLC header so making any protocol‘pseudo-IEEE compliant’. The SNAP tag (or “snap encapsulation”) isplaced directly after the standard length/type field of the Ethernetpacket (which always takes a value less than or equal to 1500), and hasAA-AA as its first two bytes. A packet containing a SNAP tag is calledSNAPped.

Generally, an Ethernet packet is made up of levels of nested data, knownas layers. Data which is interpreted directly by a machine is called“layer 1”, or physical layer, data. “Layer 2”, or data link layer, datais LAN (local area network) data, such as MAC (media access control)data uniquely identifying an adapter on the LAN. Within the “layer 2”packet may be “layer 3”, or network layer, data defining among otherthings the IP source address and destination address of the packet.Within the layer 3 packet may be “layer 4” data, or transport layerdata, e.g. TCP (transmission control protocol) data.

In view of the great variety of protocols which may be encountered, itwould be useful to provide a parsing technique which is highly flexible.

Additionally, there are a variety of circumstances in which it would beuseful to parse a plurality of concurrently received data packets. Suchcircumstances are not limited to Ethernet applications, but, takingEthernet applications as an example, in a co-pending pending applicationreferred to above, the present inventors propose a configurable Ethernetswitch which can function both as a Fast Ethernet and as a GigabitEthernet switch, in order to facilitate the transition from FE to GEEthernet. A data port can be operated as eight FE MAC interfaces oralternatively as a single GE MAC interface. In the former case, it mayhappen that the eight FE interfaces receive packets at the same time. Itwould be possible-to provide sufficiently large buffers at the inputport that all of these packets are completely received before theprocessing of any one of the packets begins, but this increases the costof the buffers required. It would instead be useful to be able toprocess all of the packets concurrently (“on-the-fly”) as they arereceived to reduce the buffering requirement.

SUMMARY OF THE INVENTION

A first aspect of the invention proposes in general terms that a parsersystem is arranged to receive a data stream having interleaved sectionsderived from a plurality of different packets, and to extract data fromeach section as it arrives. The parser system receives information abouteach of the sections of data defining which packet it relates to, andemploys this information to identify data to be extracted from the datastream.

A second aspect of the invention relates to a parser system having anumber of programmable registers which store data for the parser, theparser system receiving a data stream and extracting data from it basedon offset information stored in the programmable registers.

In either aspect of the invention, the parser system preferably includesa scanning section which identifies the location of major structuralfeatures of data in the data stream (e.g. a location where one of thelayers of data commences), and at least one parser unit which uses theoutput of the scanning section and offset information (at least partlyfrom the programmable registers in the case of the second aspect of theinvention) to extract the data. The offset information identifies theoffset of the data to be extracted from the location of the structuralfeatures.

The scanning section uses the received information about the datastream, and also examines the data itself to identify characteristics ofpackets in the data stream. For example, in addition to determining thelocation of the start of any one or more of layer 2, layer 3 and/orlayer 4 data in the packets, it may further be able to identify if thepacket is VLAD tagged and/or SNAPed.

There may be two parser units, one of which extracts data according topredefined offsets and the structural data from the scanning section,and the other extracting data according to the structural data from thescanning section and offsets defined by the programmable registers.

BRIEF DESCRIPTION OF THE FIGURES

Preferred features of the invention will now be described, for the sakeof illustration only, with reference to the following figures in which:

FIG. 1 shows schematically the operation of a parser system which is anembodiment of the invention;

FIG. 2 shows schematically how key extraction is performed by the secondparser and combiner of the embodiment of FIG. 1;

FIG. 3 shows the structure of 4 types of packets to be parsed by theembodiment, and

FIG. 4 shows the parser system of FIG. 1 as a circuit diagram.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Referring firstly to FIG. 1, the operation of the embodiment is shownschematically.

The embodiment processes a data steam having packets 1 containing layer2 data 2 (starting at bit 0) and layer 3 data 3 In fact the packet willalso contain layer 4 data, but for the purposes of this embodiment thismay be treated simply as part of the level 3 data. The position of thestart of the layer 4 data is given by a field which is part of the layer3 data.

The data stream enters FIG. 1 as a series of sections of predeterminedlength. Preferably the data stream consists of a series of concurrentpackets interleaved. For example, there may be up to 8 packets, whichare divided into sections (e.g. of 8 bytes at a time), the sections ofdifferent data packets being interleaved. The steps of FIG. 1 areperformed on one of these sections at any time, using information aboutwhich of the packets the section comes from. This means that there is noneed to buffer the entire data stream as it arrives.

The first step (step 5) of the operation is to determine the layer 3start offset, and whether the data is VLAN tagged or SNAPed. To beginwith, for each 8 bytes received the algorithm calculates variousvariables as follows. Firstly, it updates a count variable (length)which indicates the number of bytes of the packet received so far, byadding the number of new bytes to the previous value of length. Avariable index is defined as the largest integer which is no greaterthan length divided by 8. A variable offset is then defined as lengthmodulus 8.

FIG. 3 shows the variables index and offset for 4 types of packet,labelled (a), (b), (c) and (d) having the data shown in byte locationsmarked by the row marked as “byte number”.

-   -   Packet type (a) is not VLAN tagged or snapped, and layer 3        starts at byte 14.    -   Packet type (b) is VLAN tagged (so that bytes 12 and 13 are        0x8100 (a hex notation) and layer 3 starts at byte 18.    -   Packet type (c) is SNAPped with snap encapsulation starting at        byte 14, and layer 3 data starts at byte 22. The bytes at        positions 14 to 19 are 0xAA-AA-03-00-00-00.    -   Packet type (d) is SNAPped with snap encapsulation starting at        byte 18 and also VLAN tagged (so that bytes 12 and 13 are 8100),        and layer 3 data starts at byte 26. The bytes at positions 18 to        23 are 0xM-AA-03-00-00-00.

To determine the position of the L3 start, the following steps areperformed at a time when the variable length is such that index is 1:

-   -   Check the bytes at offset 4 and 5. If they are not 0x8100 and        not less than 1500, then the byte is type (a), and layer 3        starts at byte 14.    -   Otherwise, if the bytes at offset 4 and 5 are 0x8100, then the        packet is tagged (the packet must be type (b) or type (d)). Set        a variable tagged to be equal to 1.    -   Otherwise, if the bytes at offset 4 and 5 are less than or equal        to 1500, and the bytes at offsets 6 and 7 are 0xAA-AA, then the        packet must be snapped. Set a variable snapped to be equal to 1.    -   Otherwise, the packet is in an unknown protocol.

When the next section of the data packet arrives, so that the variablelength is such that index is 2:

-   -   Check the bytes at offsets 0 and 1. If they are greater than        1500 and tagged=1, then the packet is type (b) and layer 3        begins at byte 18.    -   Otherwise, if the bytes at offsets 0 and 1 are less than or        equal to 1500 and tagged=1, then set snapped=1.

If tagged=1 and snapped=1 and the bytes at offsets 2 to 7 areAA-AA-03-00-00-00, then the packet is type (d), and layer 3 starts atbyte 22.

-   -   Otherwise, if tagged=0 and snapped=1 and the bytes at offsets 0        to 3 are 0x03-00-00-00, then the packet is type (c), and layer 3        starts at byte 22.    -   Otherwise, the protocol is unknown.

Referring once more to FIG. 1, once the positions of the start of thelayer 3 (and other layers) are known, the section of the data stream ispassed to a first parser 7 and to a second parser 9 as discussed below.Note that the step 5 operation, and the first parser 7 and second parser9 operations are performed on one of these sections at any time. In thiscase, the step 5 operation uses section identity information identifyingwhich packets the section of data belongs to, and for example in thecase that there are multiple packets maintains a set of variables (e.g.variable length) for each of those packets. In the processing of asection of the data stream derived from a given packet, step 5 involvesupdating the variables for the corresponding packet. The parsers 1 and 2do not have to know this information however.

The first parser 7 extracts data from the packet according to positionsdefined by a set of registers 8. For example, when 8 bytes are to beextracted, 8 registers (labelled Offset reg 1, . . . , Offset reg 8) areused. Each register holds an indication (“L 2 /L 3 ”) of whether data isto be extracted from the layer 2 or layer 3 data, and also an offsetindicating which bytes are to be extracted relative to this startingpositions of those layers. In this way the first parser 7 is able toextract local keys. The extracted local keys are compared in an ANDoperation 11 with 8 16-bit masks 15 (each of the 8 registers extracts 16bits). The same 8 16-bit masks 15 are compared with 8 16-bit rules 17 byan AND operation 13. The results of the AND operations 13 and 11 arecompared in step 19 to produce 8 1-bit results.

Meanwhile the second parser 9 receives the same data stream and theresults of the determination of the start of the layers, and extracts aset of 8 bits determined by 8 key selection registers 23. The outputs ofthe second parser 9 are compared with those of the compare operation 19in a step 21.

The operation of the second parser 9 and of the combine unit 21 is shownin FIG. 2. The upper portion of FIG. 2 shows the conventional structureof a data packet, starting with layer 2 data (“L2 info”), then layer 3data (“L3 info”), then layer 4 data (“L4 info”). Using the results ofthe layer position determination algorithm, the second parser 9 is fedselected ones of the bytes as shown of FIG. 2. According to the outputsof programmable selector 23, the MUX multiplex units 25 output one oftheir inputs. These are fed to further MUX multiplex units 27, 29. TheMUX units 27 receive other portions of the data packet, and also outputof the first parser 7. The MUX units 29 receive the respective outputsof the MUX units 27, and also of the respective MUX units 25. MUX units27, 29 are controlled based on selection signals sel[0] 31, sec[3] 31,which also come from the programmable registers 23. The result is theextracted key for the flow engine.

Referring to FIG. 1 again, a combination 21 of the outputs of thecompare operation 19 and the key for the flow engine is made, togenerate a final key. The uses of this key will be clear to a skilledreader, as will the exact operation of the two parsers.

FIG. 4 shows the layout of a parser system circuit 35 for implementingthe steps of FIG. 1 in the context of an Ethernet switch. The parsersystem circuit 35 operates on 8 bytes at a time, and has an inputinterface 41 which receives inputs from a buffer rx_ififo 39 whichreceives packets from the pins of the Ethernet switch, and also from aMAC interface rx_max_ififo 37 which provides control informationincluding an index identifying the packet description associated withthe corresponding packet (this constitutes the section identificationinformation discussed above). The step 5 operation of FIG. 1 isimplemented by a unit 43, and the results transmitted inter alia to aunit 45 which functions as the first and second parser and performs thecombinations shown in FIG. 1 to generate the final key. The unit 45receives the other data it requires, such as the data of registers 9, 17and 15 of FIG. 2, from a register file 47. The parser puts all theinformation for each stream of data (i.e. for each of the concurrentpackets) within the packet descriptor for the corresponding packet. Byoperating on 8 bytes at a time with 2 cycles per processing step theparser is able to manage 8 FE streams.

The output of the unit 45 passes to an output interface 49 of the parserparser_mem_iface, which in turn passes it to other components of theEthernet switch, in particular to a memory manager rx_mem_mgr 51. Notethat all the circuitry of the parser system circuit 35 is preferablyimplemented on a single integrated circuit.

1. A parser system comprising: an interface configured to receive a datastream composed of interleaved sections of a plurality of differentpackets, and to receive section identity information about each of thesections of data defining to which packet it relates; a scanning sectionconfigured to identify structural features of the packets using thesection identify information, the structural features including thelocation of the start of one or more of layer 2 and layer 3 data in thepackets; and a parsing unit configured to process the data stream in asection-by-section manner and to employ the section identity informationto identify and extract data from the sections of the plurality ofdifferent packets, the parsing unit comprising: a first parserconfigured to extract data using offset information stored inuser-programmable registers, the user offset information including anindication of whether data is to be extracted from the layer 2 or layer3 data, and an indication of the location of the data to be extractedrelative to the location of the start of the layer 2 or layer 3 data;and a second parser configured to extract data from the packets inlocations defined by the identified structural features of the packetsand predetermined offset information.
 2. The parser system according toclaim 1, wherein the scanning section is further configured to identifytagged packets.
 3. The parser system of claim 2 wherein the scanningsection is further configured to identify snapped packets.
 4. The parsersystem according to claim 1, wherein the interface is configured toreceive a data stream including eight packets, each of which are dividedinto sections eight bytes in length, the sections of the eight packetsbeing interleaved.
 5. The parser system according to claim 4, whereinthe scanning section is further configured to calculate a set ofvariables for each eight bytes received, the set of variables including:a length variable which indicates the number of bytes received so far,an index variable which indicates the largest integer which is nogreater than the length variable divided by eight, and an offsetvariable which indicates the length variable modulus eight.
 6. Theparser system according to claim 5, wherein the scanning section isconfigured to identify, based on the set of variables calculated, thestart of the layer 3 of the packets and whether the packets include aVLAN or SNAP tag.
 7. The parser system according to claim 5, wherein thefirst parser is configured to extract eight 16-bit local keys using theoffset information stored in the user-programmable registers, andwherein the parsing unit is further configured to: perform an ANDoperation on the extracted local keys and eight 16-bit masks; perform anAND operation on the masks and eight 16-bit rules, and compare theresults of the AND operations to produce eight 1-bit results.
 8. Theparser system according to claim 7, wherein the second parser isconfigured to extract a set of eight bits using the predetermined offsetinformation provided in key selection registers, and wherein the parsingunit further comprises a combine unit configured to combine the set ofeight bits and the eight 1-bit results to produce a final key.
 9. Amethod of parsing a data stream using a computer includinguser-programmable registers, and a scanning section in communicationwith a first parser and a second parser, the method comprising:receiving a data stream composed of interleaved sections of a pluralityof different packets; receiving section identity information about eachof the sections of data defining which packet it relates to; andprocessing the data stream in a section-by-section manner, saidprocessing including: using the scanning section to identify structuralfeatures of the packets using the section identity information, thestructural features including the location of the start of one or moreof layer 2 and layer 3 data in the packets extracting, using the firstparser, data from the sections of the plurality of different packetsbased on offset information stored in the user-programmable registers,the offset information including an indication of whether data is to beextracted from the layer 2 or layer 3 data, and an indication of thelocation of the data to be extracted relative to the location of thestart of the layer 2 or layer 3 data; and extracting, using the secondparser, data from the sections of the plurality of different packets inlocations defined by the identified structural features of the packetsand predetermined offset information.
 10. The method of claim 9 whereinthe identifying structural features step includes identifying taggedpackets.
 11. The method of claim 10 wherein the identifying structuralfeatures step includes identifying snapped packets.
 12. The methodaccording to claim 9, wherein receiving the data stream comprisesreceiving eight packets, each of which are divided into sections eightbytes in length, the sections of the eight packets being interleaved.13. The method according to claim 12, wherein identifying structuralfeatures comprises calculating a set of variables for each eight bytesreceived, the set of variables including: a length variable whichindicates the number of bytes received so far, an index variable whichindicates the largest integer which is no greater than the lengthvariable divided by eight, and an offset variable which indicates thelength variable modulus eight.
 14. The method according to claim 13,wherein identifying structural features comprises identifying, based onthe set of variables calculated, the start of the layer 3 of thepackets, and whether the packets include a VLAN or SNAP tag.
 15. Themethod according to claim 12, wherein extracting using a first parsercomprises extracting eight 16-bit local keys based on the offsetinformation stored in the user-programmable registers, the methodfurther comprising: performing an AND operation on the extracted localkeys and eight 16-bit masks; performing an AND operation on the masksand eight 16-bit rules, and comparing the results of the AND operationsto produce eight 1-bit results.
 16. The method according to claim 15,wherein extracting using the second parser comprises extracting a set ofeight bits based on the predetermined offset information in keyselection registers, the method further comprising combining the set ofeight bits and the eight 1-bit results to produce a final key.